[UNIX] GNU rm Denial of Service

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  GNU rm Denial of Service
------------------------------------------------------------------------


SUMMARY

" <http://www.gnu.org/software/fileutils/fileutils.html> The GNU File 
Utilities are the basic file-manipulation utilities of the GNU operating 
system."

When attempting to delete big list of directories in directory-tree, rm 
crashes.

DETAILS

Vulnerable Systems:
 * rm (fileutils) version 4.1

Immune Systems:
 * rm (fileutils) version 5.2.1

Deleting 14986 (or more) sub directories with the same directory-tree with 
rm allow users to crash rm and may even execute arbitrary code.

Proof of Concept:
$ gdb -q /bin/rm
(no debugging symbols found)...(gdb)
(gdb) r -rf A
Starting program: /bin/rm -rf A
(no debugging symbols found)...(no debugging symbols found)...
Program received signal SIGSEGV, Segmentation fault.
0xb7e880dc in __lxstat64 () from /lib/libc.so.6
(gdb) i r
eax            0xbf711138       -1083109064
ecx            0x804d820        134535200
edx            0x0      0
ebx            0x0      0
esp            0xbf711000       0xbf711000
ebp            0xbf711088       0xbf711088
esi            0x809c1fb        134857211
edi            0x80a6c70        134900848
eip            0xb7e880dc       0xb7e880dc
eflags         0x10286  66182
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x0      0
fctrl          0x37f    895
fstat          0x20     32
ftag           0xffff   65535
fiseg          0x73     115
fioff          0x804b728        134526760
foseg          0x7b     123
fooff          0x804d828        134535208
fop            0x6d9    1753
mxcsr          0x1f80   8064
orig_eax       0xffffffff       -1
(gdb)


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> Carlos 
Carvalho.
The original article can be found at:  
<http://nutshell.gotfault.net/papers/adv_rm.txt> 
http://nutshell.gotfault.net/papers/adv_rm.txt



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.